add access control CORS header for browser compatibility